Network security protection method and system based on artificial intelligence

Abstract

The invention provides a network security protection method and system based on artificial intelligence, and the method comprises the steps: configuring an access control table; based on an artificial intelligence technology, constructing an intelligent protection AI; based on the intelligent protection AI and the access control table, performing first-layer security protection of the local network; and performing second-layer security protection of the local network based on the intelligent protection AI and the historical access record. According to the network security protection method and system based on artificial intelligence, the intelligent protection AI of the local network is constructed by using the artificial intelligence technology, the intelligent protection AI performs the first-layer security protection verification of the local network based on the configured access control table, and when the first-layer security protection verification is passed, the local network is protected. The visitor entering the local network is subjected to second-layer security protection verification, and two layers of verification mechanisms are introduced for automatic protection, so that the security is higher, and the system is more intelligent.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an artificial intelligence-based network security protection method and system. Background Art

[0002] Cybersecurity has always been a concern. Using local networks for communication, document management, and transaction processing can greatly improve work efficiency. However, current cyber threats are constantly evolving. For example, hackers are using AI to automate attacks, generating more realistic phishing emails or bypassing verification codes. Traditional protection methods (such as firewalls, IDS, and antivirus software) have poor network protection capabilities and insufficient security, making them unable to cope with these new attacks. Once an enterprise's critical digital assets are attacked, they will face huge losses.

[0003] In view of this, there is an urgent need for artificial intelligence-based network security protection methods and systems to at least address the above-mentioned deficiencies. Summary of the Invention

[0004] One of the purposes of the present invention is to provide an artificial intelligence-based network security protection method and system, which uses artificial intelligence technology to build an intelligent protection AI for the local network. The intelligent protection AI performs the first-layer security protection verification of the local network based on the configured access control table. When the first-layer security protection verification passes, the second-layer security protection verification is performed on visitors entering the local network. The two-layer verification mechanism is introduced for automated protection, which is more secure and intelligent.

[0005] The artificial intelligence-based network security protection method provided by the embodiment of the present invention includes:

[0006] Configure access control lists;

[0007] Build intelligent protection AI based on artificial intelligence technology;

[0008] Based on intelligent protection AI and access control lists, it provides the first layer of security protection for the local network;

[0009] Provides a second layer of security for the local network based on intelligent protection AI and historical access records.

[0010] Preferably, configuring an access control list includes:

[0011] Determine access control parameters based on dynamically set access rights for access resources on the local network;

[0012] Summarize the access control parameters and obtain the access control list.

[0013] Preferably, determining access control parameters based on dynamically set access rights for access resources in the local network includes:

[0014] When access control parameters are about to change, change exception verification is performed.

[0015] Preferably, performing change exception verification includes:

[0016] Verify that the permission setting range of the party that sets the permission to access the resource is within the permission setting range that it is allowed to change.

[0017] Preferably, performing change abnormality verification further includes:

[0018] Identify the party whose rights are relaxed and its relaxed rights;

[0019] Obtain the local network access records of the party whose permissions have been relaxed before the current moment;

[0020] If the acquisition is successful, the access features of the relaxed permissions are extracted based on the local network access records;

[0021] Determine a first verification graph based on the access characteristics to verify the first credibility of the party whose authority is relaxed;

[0022] If the first credibility is less than a preset first threshold, obtaining permission change request data from the permission setting party in the direction of relaxed permission;

[0023] Extracting permission change request features based on permission change request data;

[0024] The access feature and the permission change request feature are integrated to determine a second verification graph to verify the second credibility of the party whose permission is relaxed;

[0025] If the second credibility is less than a preset second threshold, it is determined that the change is abnormal.

[0026] The artificial intelligence-based network security protection method provided in an embodiment of the present invention further includes:

[0027] After determining the abnormal change, determine the analysis plan for the permission setting verification vulnerability based on the type of information of the permission setting verification information corresponding to the abnormal change by the permission setting personnel;

[0028] Based on the analysis results of the analysis plan, determine the permission setting verification loopholes;

[0029] Fixed a permission setting verification vulnerability.

[0030] Preferably, fix the permission setting verification vulnerability, including:

[0031] Determine a vulnerability verification node that generates an authority setting verification vulnerability on a preset verification link;

[0032] Determine the isolated verification node based on the first verification feature of the vulnerable verification node and the second verification features of other verification nodes on the verification chain;

[0033] Generate permissions based on the verification identity set corresponding to the isolated verification node to set the isolation mechanism;

[0034] Before the permission setting verification vulnerability is fixed, the permission setting isolation mechanism will be used to isolate the person who requested permission relaxation for the isolated verification node.

[0035] Preferably, the first layer of security protection for the local network is implemented based on intelligent protection AI and access control lists, including:

[0036] Identify the visitor's access request, which includes: the visitor's identity and the requested resource;

[0037] Based on the requested access resource and the access control list, the access request of the visitor whose identity matches the identity allowed to access the corresponding resource is responded to.

[0038] Preferably, a second layer of security protection for the local network is provided based on intelligent protection AI and historical access records, including:

[0039] Establish an access behavior model corresponding to the local user identity;

[0040] Based on the access behavior model, the access behavior of visitors entering the local network is detected for access behavior anomalies.

[0041] The artificial intelligence-based network security protection system provided by the embodiment of the present invention includes:

[0042] Control table configuration module, used to configure access control table;

[0043] Protection model building module, used to build intelligent protection AI based on artificial intelligence technology;

[0044] The first protection module is used to provide the first layer of security protection for the local network based on intelligent protection AI and access control lists;

[0045] The second protection module is used to provide the second layer of security protection for the local network based on intelligent protection AI and historical access records.

[0046] The beneficial effects of the present invention are:

[0047] The present invention uses artificial intelligence technology to build an intelligent protection AI for the local network. The intelligent protection AI performs the first layer of security protection verification of the local network based on the configured access control table. When the first layer of security protection verification passes, the second layer of security protection verification is performed on visitors entering the local network. The two-layer verification mechanism is introduced for automated protection, which is more secure and intelligent.

[0048] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purpose and other advantages of the present invention can be achieved and obtained through the structures specifically pointed out in this application document.

[0049] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0051] Figure 1 Schematic diagram of an artificial intelligence-based network security protection method according to an embodiment of the present invention;

[0052] Figure 2 Schematic diagram of an artificial intelligence-based network security protection system in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0054] The embodiment of the present invention provides a network security protection method based on artificial intelligence, such as Figure 1 Shown, including:

[0055] Step 1: Configure access control list;

[0056] The access control table includes access control parameters, which define the visitor's identity and the local network resources that the visitor is allowed to access.

[0057] Step 2: Build intelligent protection AI based on artificial intelligence technology;

[0058] Among them, when building intelligent protection AI, machine learning manually records the process of blocking visitors with different access identifiers according to the preset access control table, and machine learning manually establishes access behavior models for different internal network personnel identifiers corresponding to personnel types based on the historical access habits of personnel entering the internal network, and verifies the subsequent access behavior of this personnel type based on the access behavior model;

[0059] Step 3: Implement the first layer of security protection for the local network based on intelligent protection AI and access control lists;

[0060] The local network is a local area network that requires network protection, such as an enterprise's intranet. During the first layer of security protection, the access request of the visitor is identified, which includes the visitor's identity and the local network resources they want to access. The intelligent protection AI performs the first layer of access verification on the accessing user according to the access control list. If the first layer of security protection verification fails, the corresponding visitor is directly blocked from entering the local network.

[0061] Step 4: Provide a second layer of security for the local network based on intelligent protection AI and historical access records.

[0062] Among them, when the first layer of security protection verification is passed, the second layer of security protection verification is triggered (that is, verifying whether the visitor's access behavior conforms to the access behavior model corresponding to his identity identification). When the second layer of security protection verification fails, a vulnerability analysis is performed based on the visitor data of the corresponding visitor (for example: whether there is a mismatch in access rights, whether there is a technical vulnerability in identity identification), and adjustments are made based on the vulnerability analysis results.

[0063] The working principle and beneficial effects of the above technical solution are:

[0064] The present invention uses artificial intelligence technology to build an intelligent protection AI for the local network. The intelligent protection AI performs the first layer of security protection verification of the local network based on the configured access control table. When the first layer of security protection verification passes, the second layer of security protection verification is performed on visitors entering the local network. The two-layer verification mechanism is introduced for automated protection, which is more secure and intelligent.

[0065] In one embodiment, configuring an access control list includes:

[0066] Determine access control parameters based on dynamically set access rights for access resources on the local network;

[0067] The access rights to resources are dynamically set by the administrator of the local network, including the access behaviors allowed to different access identities. For example, visitors are prohibited from accessing resource file A, first-level employees are associated with "read-only" permissions for resource file A, and second-level employees are associated with "read and write" permissions for resource file A.

[0068] Summarize the access control parameters and obtain the access control list.

[0069] The working principle and beneficial effects of the above technical solution are:

[0070] The present invention determines access control parameters based on the access rights dynamically set by an administrator, aggregates the access control parameters to obtain an access control table, and updates the access control table more timely.

[0071] In one embodiment, determining access control parameters based on dynamically set access permissions for access resources in a local network includes:

[0072] When access control parameters are about to change, change exception verification is performed.

[0073] Among them, when the access control parameters are ready to change refers to the period from when the dynamically set access rights for accessing resources are detected to when the corresponding access control parameters are formally changed; change exception verification refers to the rationality check of the access control parameter change before changing the access control parameters, such as checking whether the scope of the permission change of the permission changer (the permission setting party) of the access rights is within the scope of its allowed changes.

[0074] The working principle and beneficial effects of the above technical solution are:

[0075] The present invention performs a rationality check (change abnormality verification) on the access control parameter change when the access control parameter is about to be changed. When a change abnormality occurs, the change of the corresponding access control parameter is stopped, thereby improving the standardization of the dynamic change of the access control parameter.

[0076] In one embodiment, performing change exception verification includes:

[0077] Identify the party whose rights are relaxed and its relaxed rights;

[0078] The party whose permissions are relaxed is the ID of the person whose resource permissions are relaxed, for example, employee C. The relaxed permissions are the relaxed permissions of the party whose permissions are relaxed, for example, employee C's read-only permission on resource file A is changed to read-write permission.

[0079] Obtain the local network access records of the party whose permissions have been relaxed before the current moment;

[0080] The local network access record is the resource access results of the party whose permissions have been relaxed on the local network before the current time. For example, employee C attempts to edit resource file A but the edit fails.

[0081] If the acquisition is successful, the access features of the relaxed permissions are extracted based on the local network access records;

[0082] The access feature is the corresponding relationship between the resource access result and the resource access time, for example, time T is access failure and time T+1 is access success.

[0083] Determine a first verification graph based on the access characteristics to verify the first credibility of the party whose authority is relaxed;

[0084] Among them, the first verification graph is: a resource access result distribution graph obtained by sorting the resource access results corresponding to the access features based on the order of the access times corresponding to the access features; when verifying the first credibility of the party whose authority is relaxed, the first verification graph is matched with a preset resource access result distribution graph in a preset first credibility determination library. If a preset resource access result distribution graph with a consistent resource access result distribution is matched, the preset credibility identified in the library is used as the first credibility. The first credibility determination library is pre-configured manually, for example: the more consecutive resource access results are consecutive and the access results are failed, the shorter the time interval between the results is, and the smaller the corresponding preset credibility is;

[0085] If the first credibility is less than a preset first threshold, obtaining permission change request data from the permission setting party in the direction of relaxed permission;

[0086] The preset first threshold is manually preset; the permission change request data is: a request record from the permission-relaxed party to the permission-setting party to relax its corresponding relaxed permission before the current moment;

[0087] Extracting permission change request features based on permission change request data;

[0088] Among them, the characteristics of the permission change request are: permission change request content and its corresponding request time;

[0089] The access feature and the permission change request feature are integrated to determine a second verification graph to verify the second credibility of the party whose permission is relaxed;

[0090] Among them, when integrating the access feature and the permission change request feature, the permission change request content is marked in the first verification graph in the order of the request time to obtain the second verification graph; when verifying the second credibility, the second verification graph is matched with the preset resource access result and permission change request content distribution graph in the preset second credibility determination library. If the preset resource access result and permission change request content distribution graph with consistent distribution are matched, the preset credibility identified in the library is used as the second credibility. For example: the preset resource access result and permission change request content distribution graph is: after each permission change request content, there is a resource access result that is a resource access result of failed access, and the feature closest to the current moment is the permission change request feature, and its corresponding preset credibility is 70. For example: the preset resource access result and permission change request content distribution graph is: continuous resource access results are resource access results of failed access, and its corresponding preset credibility is 20;

[0091] If the second credibility is less than a preset second threshold, it is determined that the change is abnormal.

[0092] The second threshold is preset manually.

[0093] The working principle and beneficial effects of the above technical solution are:

[0094] The present invention incorporates the local network access records of the party whose permissions have been relaxed prior to the current moment and extracts access features of the relaxed permissions. Based on the access features, a first verification graph is constructed to determine a first credibility level for the party whose permissions have been relaxed. When the first credibility level is less than a first threshold, permission change request data is introduced to extract permission change request features. The access features and permission change request features are then combined to determine a second verification graph. A second verification is then performed based on the second credibility level determined from the second verification graph. When the second credibility level is less than a preset second threshold, a change anomaly is determined, resulting in a more accurate determination of the change anomaly.

[0095] The embodiment of the present invention provides an artificial intelligence-based network security protection method, further comprising:

[0096] After determining the abnormal change, determine the analysis plan for the permission setting verification vulnerability based on the type of information of the permission setting verification information corresponding to the abnormal change by the permission setting personnel;

[0097] Among them, permission setting verification information includes: permission relaxation requests from the party whose permission is relaxed, and permission setting requests from the person who sets the permission; permission setting verification vulnerabilities are: unreasonable parts of the process verification during the entire permission setting process, such as: permission relaxation requests from the party whose permission is relaxed only require confirmation by the person who sets the permission in the system, and no credit verification is performed; analysis plans are: plans for analyzing the rationality of verification of permission setting verification information of corresponding information types, such as: plans for analyzing whether the technical means for verifying the authenticity of permission relaxation requests issued by the party whose permission is relaxed are reasonable, and plans for analyzing whether the technical means for verifying the authenticity of permission setting requests issued by the person who sets the permission are reasonable;

[0098] Based on the analysis results of the analysis plan, determine the permission setting verification loopholes;

[0099] Fixed a permission setting verification vulnerability.

[0100] The working principle and beneficial effects of the above technical solution are:

[0101] After determining the change anomaly, the present invention determines an analysis plan based on the information type of the permission setting verification information corresponding to the change anomaly, analyzes the permission setting verification information based on the analysis plan, determines the final permission setting verification vulnerability and repairs it, and traces the permission setting verification vulnerability in time, thereby further improving system security.

[0102] In one embodiment, the permission setting verification vulnerability is fixed, including:

[0103] Determine a vulnerability verification node that generates an authority setting verification vulnerability on a preset verification link;

[0104] The preset verification chain is a complete process consisting of a series of logical nodes in the permission setting verification process. Each node is responsible for a specific verification task, such as verifying the credit stamp of the person requesting permission relaxation and verifying the setting key of the person setting the permission. The vulnerability verification node is the verification chain node where the verification task fails, determined based on the permission setting verification vulnerability obtained from the above analysis.

[0105] Determine the isolated verification node based on the first verification feature of the vulnerable verification node and the second verification features of other verification nodes on the verification chain;

[0106] The verification characteristics are: the verification technology used by the verification node to perform the verification task; when determining the isolated verification node, other corresponding verification nodes with similar verification technology as the vulnerable verification node are used together with the vulnerable verification node as isolated verification nodes;

[0107] Generate permissions based on the verification identity set corresponding to the isolated verification node to set the isolation mechanism;

[0108] The verification identification set is: the identity of the verification personnel corresponding to the isolated verification node; the permission setting isolation mechanism is: a protection strategy that temporarily limits the impact of the vulnerability;

[0109] Before the permission setting verification vulnerability is fixed, the permission setting isolation mechanism will be used to isolate the person who requested permission relaxation for the isolated verification node.

[0110] The working principle and beneficial effects of the above technical solution are:

[0111] The verification link is a complete process composed of a series of logical nodes in the permission setting verification process. Each node is responsible for a specific verification task. The verification link is divided into multiple link levels. The verification tasks of the corresponding nodes in each link level are similar. For example: the verification task of the node at the first link level is to verify the credit stamp of the person requesting permission relaxation, and the verification task of the node at the second link level is to verify the setting key of the person setting the permission, and determine the vulnerability verification node that generates the permission setting verification vulnerability on the verification link.

[0112] After determining the vulnerability verification node, extract the first verification feature of the vulnerability verification node (the verification technical means of the verification task performed by the vulnerability verification node), and match the first verification feature with the second verification feature of other verification nodes at the same link level corresponding to its vulnerability verification node. If the verification technical means are similar, the verification method of the vulnerability verification node has been compromised, and the subsequent verification process behavior of other verification nodes with similar verification technical means is also untrustworthy. Therefore, the corresponding other verification nodes and the vulnerability verification node are used as isolated verification nodes together.

[0113] Based on the identity of the validator corresponding to the isolated verification node, a permission setting isolation mechanism is determined. For example, this can restrict permission relaxation requests from a specific person, or restrict permission settings from a specific person. Before the permission setting verification vulnerability is fixed, the permission setting isolation mechanism is used to isolate the permission settings of the person requesting permission relaxation corresponding to the isolated verification node. This achieves local isolation of risk vulnerabilities, improves protection efficiency, and provides a more reasonable protection solution.

[0114] The embodiment of the present invention provides a network security protection system based on artificial intelligence, such as Figure 2 Shown, including:

[0115] Control table configuration module 1, used to configure the access control table;

[0116] Protection model construction module 2, used to build intelligent protection AI based on artificial intelligence technology;

[0117] The first protection module 3 is used to provide the first layer of security protection for the local network based on intelligent protection AI and access control lists;

[0118] The second protection module 4 is used to provide a second layer of security protection for the local network based on intelligent protection AI and historical access records;

[0119] The control table configuration module configures the access control table, including:

[0120] Determine access control parameters based on dynamically set access rights for access resources on the local network;

[0121] Summarize access control parameters and obtain access control list;

[0122] The access control parameters are determined based on the dynamically set access rights for access resources in the local network, including:

[0123] When access control parameters are about to be changed, change exception verification is performed;

[0124] Among them, change exception verification includes:

[0125] Identify the party whose rights are relaxed and its relaxed rights;

[0126] Obtain the local network access records of the party whose permissions have been relaxed before the current moment;

[0127] If the acquisition is successful, the access features of the relaxed permissions are extracted based on the local network access records;

[0128] Determine a first verification graph based on the access characteristics to verify the first credibility of the party whose authority is relaxed;

[0129] If the first credibility is less than a preset first threshold, obtaining permission change request data from the permission setting party in the direction of relaxed permission;

[0130] Extracting permission change request features based on permission change request data;

[0131] The access feature and the permission change request feature are integrated to determine a second verification graph to verify the second credibility of the party whose permission is relaxed;

[0132] If the second credibility is less than a preset second threshold, determining that the change is abnormal;

[0133] After determining the abnormal change, determine the analysis plan for the permission setting verification vulnerability based on the type of information of the permission setting verification information corresponding to the abnormal change by the permission setting personnel;

[0134] Based on the analysis results of the analysis plan, determine the permission setting verification loopholes;

[0135] Fixed the permission setting verification vulnerability;

[0136] Among them, the permission setting verification vulnerability is fixed, including:

[0137] Determine a vulnerability verification node that generates an authority setting verification vulnerability on a preset verification link;

[0138] Determine the isolated verification node based on the first verification feature of the vulnerable verification node and the second verification features of other verification nodes on the verification chain;

[0139] Generate permissions based on the verification identity set corresponding to the isolated verification node to set the isolation mechanism;

[0140] Before the permission setting verification vulnerability is fixed, the permission setting isolation mechanism will be used to isolate the person who requested permission relaxation for the isolated verification node.

[0141] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A network security protection method based on artificial intelligence, characterized in that: include: Configure access control lists; Build intelligent protection AI based on artificial intelligence technology; Based on intelligent protection AI and access control lists, it provides the first layer of security protection for the local network; Provides a second layer of security for the local network based on intelligent protection AI and historical access records.

2. The network security protection method based on artificial intelligence according to claim 1, characterized in that: Configure the access control list, including: Determine access control parameters based on dynamically set access rights for access resources on the local network; Summarize the access control parameters and obtain the access control list.

3. The network security protection method based on artificial intelligence according to claim 2, characterized in that: Determine access control parameters based on dynamically set access rights for resources accessed on the local network, including: When access control parameters are about to change, change exception verification is performed.

4. The network security protection method based on artificial intelligence according to claim 3, characterized in that: Perform change exception verification, including: Verify that the permission setting range of the party that sets the permission to access the resource is within the permission setting range that it is allowed to change.

5. The network security protection method based on artificial intelligence according to claim 3, characterized in that: Perform change exception verification, including: Identify the party whose rights are relaxed and its relaxed rights; Obtain the local network access records of the party whose permissions have been relaxed before the current moment; If the acquisition is successful, the access features of the relaxed permissions are extracted based on the local network access records; Determine a first verification graph based on the access characteristics to verify the first credibility of the party whose authority is relaxed; If the first credibility is less than a preset first threshold, obtaining permission change request data from the permission setting party in the direction of relaxed permission; Extracting permission change request features based on permission change request data; The access feature and the permission change request feature are integrated to determine a second verification graph to verify the second credibility of the party whose permission is relaxed; If the second credibility is less than a preset second threshold, it is determined that the change is abnormal.

6. The network security protection method based on artificial intelligence according to claim 5, characterized in that: Also includes: After determining the abnormal change, determine the analysis plan for the permission setting verification vulnerability based on the type of information of the permission setting verification information corresponding to the abnormal change by the permission setting personnel; Based on the analysis results of the analysis plan, determine the permission setting verification loopholes; Fixed a permission setting verification vulnerability.

7. The network security protection method based on artificial intelligence according to claim 6, characterized in that: Fixed a permission setting verification vulnerability, including: Determine a vulnerability verification node that generates an authority setting verification vulnerability on a preset verification link; Determine the isolated verification node based on the first verification feature of the vulnerable verification node and the second verification features of other verification nodes on the verification chain; Generate permissions based on the verification identity set corresponding to the isolated verification node to set the isolation mechanism; Before the permission setting verification vulnerability is fixed, the permission setting isolation mechanism will be used to isolate the person who requested permission relaxation for the isolated verification node.

8. The network security protection method based on artificial intelligence according to claim 1, characterized in that: Based on intelligent protection AI and access control lists, it provides the first layer of security protection for the local network, including: Identify the visitor's access request, which includes: the visitor's identity and the requested resource; Based on the requested access resource and the access control list, the access request of the visitor whose identity matches the identity allowed to access the corresponding resource is responded to.

9. The network security protection method based on artificial intelligence according to claim 1, characterized in that: Based on intelligent protection AI and historical access records, it provides a second layer of security protection for the local network, including: Establish an access behavior model corresponding to the local user identity; Based on the access behavior model, the access behavior of visitors entering the local network is detected for access behavior anomalies.

10. The network security protection system based on artificial intelligence is characterized by: include: Control table configuration module, used to configure access control table; Protection model building module, used to build intelligent protection AI based on artificial intelligence technology; The first protection module is used to provide the first layer of security protection for the local network based on intelligent protection AI and access control lists; The second protection module is used to provide the second layer of security protection for the local network based on intelligent protection AI and historical access records.

Images